A questionnaire arrives from a prospective customer, a prime, or a marketplace. Somewhere in it is a line like this: At what impact level is your product authorized? Select all that apply: IL2, IL4, IL5, IL6.
It looks like a checkbox. It is really three questions packed into one: what you hold, what you inherit, and what the customer actually needs. Answering it badly is how vendors end up claiming a status that belongs to somebody else. This post gives a way to answer it truthfully, and a way to work out which level your data calls for. It builds on the impact-level post, which explains why the question is shaped so oddly.
The question assumes your product holds a level
Most products do not. An impact level is carried by a Provisional Authorization, and the DoD cloud authorization process says who gets one: the PA "is issued by the DISA Authorizing Official (AO) for a CSO", a cloud service offering, "based on FedRAMP and additional DoD security requirements (Impact Levels 4/5/6)." It is granted to the provider for their offering. It is issued with an expiration date.
What the customer gets is a different instrument: an authorization to operate for their own system boundary, granted by their component's authorizing official.
So a PA belongs to a cloud service offering and an ATO belongs to the system the customer fields. Your product is usually neither. It is software that runs on somebody's offering, inside the customer's boundary. Which means the honest answer depends on which of four situations you are in.
Four honest answers
| Your situation | What is true | A truthful answer |
|---|---|---|
| You operate a cloud service offering with a DoD PA | The PA is yours, it names a level, and it expires | "DoD Provisional Authorization at IL[x], expires [date]." Be ready to share the PA memo. |
| Your software runs on an authorized platform and inherits its controls | The platform holds the PA. The customer's AO holds the system authorization. | "Deployed on [platform], which holds a DoD PA at IL[x]. We inherit its infrastructure controls. System authorization rests with the customer's AO." |
| You hold FedRAMP only | For DoD, FedRAMP Moderate or High is "essentially an automatic DOD Impact Level 2 PA". It is not IL4 or above. | "FedRAMP [Moderate/High] authorized, eligible for IL2. No DoD PA at IL4 or above." |
| You hold nothing yet | It is a plan, not a status | "No authorization held. Target environment: [platform at IL[x]]. Here is the path and the timeline." |
The second row is where most commercial vendors are, and it is the one most often answered wrongly. Ticking IL5 because the platform you run on is IL5 claims a property that belongs to somebody else's product, and it puts a statement on paper that the customer's authorizing official will read closely, because the authorization is theirs to grant.
Being specific about what you inherit is also what makes the answer credible. Since the July 2025 revision of the Cloud Service Provider SRG, a provider must supply "a responsibility matrix and configuration guide(s)" showing which controls are theirs and which are yours. The fourth post in the names series covers how that inheritance works. Ask the platform for the matrix before you write the sentence.
Platforms that exist for exactly this situation describe it in the same terms. Second Front, for example, says its Game Warden platform "meets Impact Level (IL) 5" and that its DISA provisional authorization allows "customers to inherit Game Warden's validated security controls." That is the vendor's own description rather than an independent audit, but it is the shape of the second row.
Which level does your data call for?
Start from the information, not from the product. The mission-owner guidance says the levels "combine the type of information to be stored and processed in the CSP environment and the potential impact of an event that results in the loss of confidentiality, integrity, or availability." The level follows the data and what losing it would cost. The product does not set it.
That settles a question that comes up a great deal: which impact level do I need for my AI workload? There is no AI level. The Cloud Service Provider SRG defines each level by the information it accommodates, and it has no category for AI or for any other kind of workload. The answer is the same as for any system. It depends on the data you will put in it, and on whether the system is a national security system, which turns on what the system is used for rather than on the technology inside it.
Working from the data:
- Public or non-CUI information points to IL2. The SRG describes it as accommodating "publicly releasable data or nonpublic unclassified data" that is not designated as CUI or military mission data.
- CUI and other unclassified mission data points to IL4.
- Unclassified national security systems point to IL5. Since July 2025 that is a statutory test, not a judgment about sensitivity.
- Classified information up to Secret points to IL6, which is a different network and a different provider pool.
- Top Secret and SCI have no impact level. They fall under a separate regime.
The side-by-side comparison, and the exact differences between IL4, IL5 and IL6, are in the impact-level post.
You cannot decide this yourself, and you should not try. The SRG puts the call elsewhere: "Determination of the appropriate Impact Level for a specific mission with CUI and mission data will be the responsibility of the mission AO." The honest line to put in your own answer is that the level is to be determined by the mission owner's authorizing official. Ask the customer for the categorization rather than guessing at it.
A customer may choose a higher level than the data needs. The guidance says a mission owner "may choose a higher level to process data from a lower level of information", then adds: "DISA recommends organizations select cloud services based on appropriate risk levels." Asking for IL5 as a precaution narrows the field of providers and raises the price, which is why a customer who offers you a choice deserves a direct question about what the data actually is.
Is FedRAMP High enough for DoD?
At IL4 and above, no. FedRAMP is the starting point.
The SRG assesses IL4 against "The FedRAMP Moderate or High baseline, supplemented with DOD FedRAMP+ security controls, CNSSI 1253 overlays based on data or mission being processed/stored, and other requirements in this SRG." IL5 and IL6 start from FedRAMP High and add the national security system controls. In each case DISA's assessors then prepare an overall determination of risk, and the DISA authorizing official issues a separate PA.
The one place FedRAMP is enough is IL2, where "any CSP/CSO compliant at the FedRAMP Moderate or High level may be used at DOD Impact Level 2 without a written DOD PA." And the SRG is clear that the two systems are not interchangeable: "Impact Levels are a DOD construct only." What FedRAMP costs a provider, and why that matters for who can quote what, is the subject of a separate post.
How to check a claim, yours or anyone else's
Customers will check, so do it first.
Name the offering and the authorization it holds. The mission-owner guidance makes the mission owner "responsible for selecting CSP offerings that are approved in accordance with the Cloud Computing SRG and have a DOD Provisional Authorization (PA)." Expect the question to be asked of you, and ask it of anyone you depend on.
Ask for the impact level and the expiration date. A PA "is issued with an expiration date" and can lapse. Your answer is only as current as the platform's authorization.
Look it up, rather than trusting a slide. The FedRAMP Marketplace "provides a list of cloud services authorized by both the JAB and Agencies under FedRAMP," and the SRG also refers to a "DOD Cloud Service Catalog" of offerings. Which platforms hold which levels changes, so a blog post is the wrong place to look for a list, including this one. Ask the provider to show you the entry.
Get the responsibility matrix. It is what turns "we inherit its controls" into a specific, defensible statement.
If you cannot answer yet
If a questionnaire is asking this and you cannot yet say truthfully what you hold, that is a finding, and it is much cheaper to learn it before a customer asks. An enclave fit study deploys your product into a hardened platform stack and tells you what breaks, with a costed plan to fix it. It produces the evidence that lets you fill in the second row of that table with specifics instead of hope. Contact Millabs for a free diagnostic call if you are not sure where to start.
Robert Burckner is the founder of Millabs Corporation, a Service-Disabled Veteran-Owned Small Business. He has served as ISSM and ISSE for legacy weapon systems at the Air Force Lifecycle Management Center and as Division Chief at the Space Warfighting Analysis Center (USSF/NRO). Millabs has deployed commercial software to IL-4 and TOP SECRET environments operational on JWICS.